[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Computer Security Division 2004 Annual Report:

Security  accreditation is  the  official  management decision to authorize operation of an information  system. This  authorization, given  by  a senior agency official, is applicable to a particular  environment  of  operation  and  explicitly accepts the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, remaining after the implementation  of  an  agreed  upon  set  of  security controls. By accrediting an information system, the agency official is not only responsible for the security of the system but is also accountable for adverse  impacts  to  the  agency  if  a  breach  of security  occurs. Security  accreditation, which  is required under OMB Circular A-130, provides a form of quality control and challenges managers and technical staff at all levels to implement the most effective security controls and techniques, given technical constraints, operational constraints, cost  and  schedule  constraints  and mission requirements. In addition to risk assessments and security plans, security evaluation also plays an important role in the  security  accreditation  process. It  is  essential that  agency  officials  have  the  most  complete, accurate and trustworthy information possible on the security status of their information systems in order  to  make  credible, risk-based  decisions  on whether to authorize operation of those systems. This  information  and  supporting  evidence  for system authorization is often developed during a detailed  security  review  of  the  information system, typically referred to as security certification . Security  certification  is  the  comprehensive evaluation of the management, operational and technical  security  controls  in  an  information system.

Computer Security Division 2004 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to 2017 NIST_ITL Cybersecurity Program Annual Report:

The 2016 Annual Report, the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework, attribute-based access control and access control standards and policies, application container security, Secure Hash Algorithm-3 (SHA-3) derived functions, cybersecurity event recovery, data integrity, recovering from ransomware and other destructive events, securing Apple OS X 10.10 systems, protecting controlled unclassified information in nonfederal information systems and organizations, systems security engineering, cyber threat information sharing, bluetooth security, the National Checklist Program, digital identity guidelines, block cipher modes of operation, the Cipher-Based Message Authentication Code (CMAC) - a Mode for Authentication, an introduction to information security, a report of the workshop on software measures and metrics to reduce security vulnerabilities, platform firmware resiliency, fog computing, de-identifying government datasets, Long Term Evolution (LTE) security, trustworthy email, security recommendations for hypervisor deployment, the Triple Data Encryption Algorithm (TDEA) Block Cipher, key-derivation methods in key-establishment schemes, pair-wise key-establishment schemes using discrete logarithm cryptography, security and privacy controls, a risk management framework for information systems and organizations, personal identity verification (PIV) credentials, access rights management for the financial services sector, securing wireless infusion pumps in healthcare delivery organizations, situational awareness for electric utilities, and domain name systemsbased electronic mail security.

2017 NIST_ITL Cybersecurity Program Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

| Audience.........................................................................................................
| 2                                                                                |
|                                                                                | Document Structure........................................................................................ | 3                                                                                |
| 2. Process-based Manufacturing System Low Impact Level Use Case ...............4                                              | 2. Process-based Manufacturing System Low Impact Level Use Case ...............4                                              | 2. Process-based Manufacturing System Low Impact Level Use Case ...............4                                            |
|                                                                                | Introduction ..................................................................................................... | 4                                                                                |
|                                                                                | Process-based Low Impact Level Use Case                                                                                | .................................................. 4                                                                        |
| 3. Policy and Procedure Implementations...............................................................9                       | 3.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Awareness and Training?

[Assistant]
According to Computer Security Division 2010 Annual Report:

Security and Health Information Technology National Initiative for Cybersecurity Education (NICE) | 9 14 | Access Control and Privilege Management Research Security for Grid and Pervasive Systems Security Ontologies: Modeling Quantitative Risk Analysis Enterprise Systems Protecting | 31 | | | 13 | NIST Cloud Computing Project Policy Machine | | | Security Practices and Policies Small and Medium Size Business Outreach | 12 12 | Automated Combinatorial Testing for Software Conformance Verification for Access Control Policies Forensics forWeb Services Mobile Handheld Device Security and Forensics | 31 32 33 33 | | | 11 11 | | | | | | | 34 | | | | | 35 35 36 | | Smart Grid Cyber Security | | | | | | | Virtualization Technologies Cloud Computing andVirtualization Laboratory | 36 36 36 | | Supply Chain Risk Management | 15 | | | | Cryptographic Validation Programs and Laboratory | 15 | Access Control and Identitiy Management in Virtualized Systems | 37 37 38 38 | | Accreditation Cryptographic ModuleValidation Program and Cryptographic | 16 16 17 18 | Security Content Automation Protocol (SCAP) National Vulnerability Database National Checklist Program Security Content Automation Protocol Validation Program |

Computer Security Division 2010 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Information Security Handbook_ A Guide for Managers:

ractor an identification credential, and also by specifying the electronic and physical properties of the credential itself. The HSPD-12 credential is known as the Personal Identity Verification card.
| CLASS       | FAMILY                                                 | IDENTIFIER   |
|-------------|--------------------------------------------------------|--------------|
| Management  | Risk Assessment                                        | RA           |
| Management  | Planning                                               | PL           |
| Management  | System and Services Acquisition                        | SA           |
| Management  | Certification, Accreditation, and Security Assessments | CA           |
| Operational | Personnel Security                                     | PS           |
| Operational | Physical and Environmental Protection                  | PE           |
| Operational | Contingency Planning                                   | CP           |
| Operational | Configuration Management                               | CM           |
| Operational | Maintenance                                            | MA           |
| Operational | System and Information Integrity                       | SI           |
| Operational | Media Protection                                       | MP           |
| Operational | Incident Response                                      | IR           |
| Operational | Awareness and Training                                 | AT           |
| Technical   | Identification and Authentication                      | IA           |
| Technical   | Access Control                                         | AC           |
| Technical   | Audit and Accountability                               | AU           |
| Technical   | System and Communications Protection                   | SC           |

Information Security Handbook_ A Guide for Managers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice PL.L2-3.15.6 (NIST 3.15.6)?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.15.6. 3.15.6.

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

The Respond Function supports the ability to contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include: Response Planning; Communications; Analysis; Mitigation; and Improvements. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity event. Examples of outcome Categories within this Function include: Recovery Planning; Improvements; and Communications.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to PIV Card to Reader Interoperability Guidelines:

The purpose of this document is to present recommendations for Personal Identity Verification (PIV) card readers in the area of performance and communications characteristics to foster interoperability.  This document is not intended to re-state or contradict requirements specifically identified in Federal Information Processing Standard 201 (FIPS 201) or its associated documents.  It is intended to augment existing standards to enable agencies to achieve the interoperability goal of Homeland Security Presidential Directive 12 (HSPD-12).

At a minimum, the contact interface shall support all card commands for contact based access specified in Section 7, End-point PIV Card Application Card Command Interface of SP 800-73-1, Interfaces for Personal Identity Verification.

At a minimum, the contactless interface shall support all card commands for contactless based access specified in Section 7, End-point PIV Card Application Card Command Interface of SP 800-73-1, Interfaces for Personal Identity Verification.

PIV Card to Reader Interoperability Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Information Security Guide for Government Executives provide? (Part 3)

[Assistant]
an effective information security program? - What are the information security laws, regulations, standards, and guidance that I need to understand to build an effective information security program?
- Where can I learn more to assist me in evaluating the effectiveness of my information security program? This guide provides the answers to those questions. ## Acknowledgements

NIST would like to thank the many people who assisted with the development of this NIST Interagency Report (NISTIR). NIST management officials who supported this effort include: Joan Hash, William C. Barker, Elizabeth Chew, and Matthew Scholl. The authors would like to thank Marianne Swanson, Jaren Doherty, and James St. Pierre, who assisted with reviewing this document and provided comments and suggestions for improvement. The authors would also like to thank Tanya Brewer for her extensive editing work. In addition, special thanks are due those contractors who helped craft the Executive Guide NISTIR, prepare drafts, and review materials:

Nadya Bartol, of BAH, served as Project Manager for BAH on this project. In addition, other BAH employees contributed to the NISTIR, including Marge Spanninger and Sedar Labarre. The authors also gratefully acknowledge and appreciate the many contributions from individuals in the public and private sectors whose thoughtful and constructive comments improved the quality and usefulness of this publication. ## Introduction

Information Security for Government Executives provides a broad overview of information security program concepts to assist senior leaders in understanding how to oversee and support the development and implementation of information security programs.

Information Security Guide for Government Executives

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Biometric Specifications for Personal Identity Verification:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, Federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Homeland Security Presidential Directive HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for Homeland Security Presidential Directive HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for new standards to be adopted governing interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems.

Biometric Specifications for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

• Design Definition
• System Analysis
• Implementation
• Integration
• Verification
• Transition
• Validation
• Operation
• Maintenance
• Disposal

During the Retirement stage, system elements or the entire system of interest are removed
from operations. The retirement process can affect other systems with which the system of
interest interacts and can decrease the cyber resiliency of those systems and of the supported
mission or business processes. Retirement strategies can include phased removal of system
elements, turnkey removal of all system elements, phased replacement of system elements, and
turnkey replacement of the entire system of interest. Cyber resiliency objectives and priorities
are identified for the systems, missions, and business functions in the operational environment
to inform analysis of the potential or expected effects of different retirement strategies on the
ability to achieve those objectives. Like the support stage, the retirement stage can introduce
significant vulnerabilities, particularly during disposal and unintended residue remaining from
decommissioned assets.33

-  Prioritize and tailor objectives for the environment of operation.
-  Ensure that disposal processes enable those objectives to be achieved,
modifying or upgrading capabilities of other systems as necessary (Re-
Architect objective).

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.3.1 Education... 3.3.1 Education... 3.3.1 Education...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.3.2 Job Experience

## Focus Groups

In the focus group demographic survey, we asked participants how many years they had worked as government employees, in their current organization, and in a cybersecurity role.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Domain Name System (DNS) Deployment Guide provide? (Part 5)

[Assistant]
............................................................... 1   | Executive Summary.................................................................................................................
1   | Executive Summary................................................................................................................. 1   |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| Changes in this Document...................................................................................................... | Changes in this Document...................................................................................................... | 4                                                                                |
| 1. Introduction.................................................................................................................... | 1. Introduction....................................................................................................................

Secure Domain Name System (DNS) Deployment Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

3.5.1  Report Recipients

3.

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Computer security; Cybersecurity Framework (CSF); distributed control systems (DCS); industrial control systems (ICS); information security; manufacturing; network security; programmable logic controllers (PLC); risk management; security controls; supervisory control and data acquisition (SCADA) systems. | Executive Summary..................................................................................................... vi        | Executive Summary..................................................................................................... vi        | Executive Summary..................................................................................................... vi   |
|----------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction ............................................................................................................1    | 1.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 1 – General Implementation Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

| Asset Management Category..................................................................................13                                                                                |                                                                                |
| 5.1.2. | Business Environment Category.............................................................................19                                                                                |                                                                                |
| 5.1.3. | Governance Category                                                                                | .............................................................................................23                                           |
| 5.1.4. | Risk Assessment Category .....................................................................................26                                                                                |                                                                                |
| 5.1.5. | Risk Management Category....................................................................................29                                                                                |                                                                                |
| 5.1.6.

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Guide to Storage Encryption Technologies for End User Devices:

3.1.3                                                                                | File/Folder Encryption... 3.1.3 File/Folder Encryption

File encryption is the process of encrypting individual files on a storage medium and permitting access to the encrypted data only after proper authentication is provided.

Guide to Storage Encryption Technologies for End User Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

| Executive Summary . . . . . . . . . . | Executive Summary . . . . . . . . . . | . . . . . . . . . . . | 1   |
|----------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1. Introduction . . . . . . . . . | 1. Introduction . . . . . . . . . | . . . . . . . . . . . . . . | 3   |
| 1.1. Document Purpose and Scope                                            | 1.1. Document Purpose and Scope                                                                                | . . . . . . . . . | 7   |
| 1.2. Intended Audience . . | 1.2. Intended Audience . . | . . . . . . . . . . . . . . | 7   |
| 1.3. Organization . . . . | 1.3. Organization . . . . | . . . . . . . . . . . . . . . | 8   |
| Introducing De-Identifcation . | Introducing De-Identifcation . | . . . . . . . . . . . . | 9   |
| 2.1. Historical Context . . | 2.1. Historical Context . . | . . . . . . . . . . . . . . | 9   |
| 2.2. Terminology . . . . | 2.2. Terminology . . . . | . . . . . . . . . . . . . . . . | 12  |
| Governance and Management of Data De-Identifcation . . | Governance and Management of Data De-Identifcation . . | Governance and Management of Data De-Identifcation . . | 18  |
| 3.1. Identifying the Goals and Intended Uses of De-Identifcation . . . . . | 3.1. Identifying the Goals and Intended Uses of De-Identifcation . . . . . | 3.1. Identifying the Goals and Intended Uses of De-Identifcation . . . . . | 18  |
| 3.2. | Evaluating the Risks and Benefts That Arise from De-Identifed Data Re- leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

- Securely Provision: Risk Management, Systems Architecture, Systems Development
- Operate and Maintain: Data Administration, Network Services, Systems Administration, Systems Analysis
- Oversee and Govern: Cybersecurity Management, Executive Cyber Leadership, Program/Project Management and Acquisition
- Protect and Defend: Cybersecurity Defense Analysis, Cybersecurity Defense Infrastructure Support, Incident Response, Vulnerability Assessment and Management

1. Provide education that describes the details necessary for malicious code protection, detection and eradication. Information that may be necessary to provide, as determined by the manufacturer's assessment of cybersecurity risk created by the IoT device, include details and actions such as:
- a. Providing education to IoT device customers for how to implement malicious code protection in the IoT device and associated systems, as well as within related systems entry and exit points, and how to detect and eradicate malicious code. - b. Providing education to IoT device customers for how to update the IoT device and related systems malicious code protection mechanisms when new releases are available, in accordance with organizational configuration management policy and procedures. - c. Providing training and awareness information to IoT device customers that describe newly identified vulnerabilities and threats (such as zero-day malware) for the associated IoT device. - d. If the IoT device manufacturer provides anti-malware for the associated IoT device, or if the IoT device has built-in anti-malware capabilities, the manufacturer should provide education to the IoT device customers describing how to use and/or configure malicious code protection mechanisms in IoT devices, supporting anti-malware tools, and related systems. - e. Providing education describing the operational impacts of the anti-malware activities on mission critical processes in the system where the IoT device is used. - f.

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

3.2.4   DEVELOP ASSESSMENT PROCEDURES FOR ORGANIZATION-SPECIFIC CONTROLS

Based on organizational policies, mission or business function requirements, and an assessment
of risk, organizations may choose to develop and implement additional (organization-specific)
controls or control enhancements for their systems that are beyond the scope of [SP 800-53].

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Configuration Management?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

| Identify | Applicability to PNT | References (PNT-Specific) | |-----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | AM-1: Physical devices and systems within the organization are inventoried.

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out:

| 11-7     |
| III. |                                          | APPLICATION SECURITY                                               | Ill-l    |
|      | A.
| Overview                                                           | Ill-l    |
|      | B. | Computer Security and Privacy Plan Preparation                     |          |
|      |                                          | (lAW OMB CIR 90-08)                                                | III-4    |
|      | C. | Certification of a Sensitive System                                | 1 11-6   |
|      | D. | Contingency Planning                                               | 111-10   |
|      | E. | Sensitive/Critical Application Review (SCAR)                       | 111-14   |
| IV. | INSTALLATION SECURITY                    | INSTALLATION SECURITY                                              | IV-1     |
|      | A. | Overview                                                           | IV-1     |
|      | B. | Risk Analysis of a System                                          | IV-3     |
|      | C. | Disaster Recovery and Continuity of Operations Planning            | IV-8     |
| V. | COMPUTER SECURITY AWARENESS AND TRAINING | COMPUTER SECURITY AWARENESS AND TRAINING                           | V-1      |
|      | A. | Overview                                                           | V-1      |
|      | B. | Computer Security Awareness and Training                           | V-2      |
| VI. | COMPUTER SECURITY INCIDENT RESPONSE      | COMPUTER SECURITY INCIDENT RESPONSE                                | VI-1     |
|      | A. | Overview                                                           | VI-      |
|      | B. | Incident Response Team                                             | VI-2     |

Sample Statement of Work for Federal Computer Security Services_ For use In-House or Contracting Out


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Access Control?

[Assistant]
According to Foundational Cybersecurity Activities for IoT Device Manufacturers:

might require safeguards not usually considered for conventional IT devices. IoT can also introduce complexities related to scale, which could make ongoing management and support of devices difficult.
- Which data needs to be protected, what types of protection each instance of data needs (i.e., confidentiality, integrity, availability), and how strong that protection needs to be
- How strongly an entity's identity needs to be authenticated before granting access if the entity is a human (e.g., PIN, password, passphrase, two-factor authentication) or system/device (e.g., API keys, certificates)
- Whether data received by or inputted into the device needs to be validated (e.g., to confirm the legitimacy of an update, to restrict the ability of malformed data to bypass access controls)
- How readily software updates can be reverted if a problem occurs (e.g., a rollback capability, an anti-rollback capability)

Foundational Cybersecurity Activities for IoT Device Manufacturers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Networks of 'Things' provide? (Part 4)

[Assistant]
poral concerns, and elements of unknown pedigree with possible nefarious intent. These primitives are the basic building blocks for a Network of 'Things' (NoT), including the Internet of Things (IoT).
This document offers an underlying and foundational understanding of IoT based on the realization that IoT involves sensing, computing, communication, and actuation. The material presented here is generic to all distributed systems that employ IoT technologies (i.e., 'things' and networks). The expected audience is computer scientists, IT managers, networking specialists, and networking and cloud computing software engineers. To our knowledge, the ideas and the manner in which IoT is presented here is unique. ## Keywords

Internet of Things (IoT); Network of Things (NoT); reliability; security; trust; trustworthiness, sensors; big data; composability; distributed system. ## Acknowledgment

Appreciation is given to Matt Scholl, Dave Ferraiolo, Tim Grance, Irena Bojanova, Angelos Stavrou, Rick Kuhn, and Phil Laplante, for the encouragement and support to take on this task. Appreciation is also given to Constantinos Kolia (GMU) for the suggestions in Section 5, and to Svetlana Lukoyanova for the artwork.

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce provide? (Part 4)

[Assistant]
Audience

The NICE Framework serves as a bridge between employers and education, training, and certification providers as well as a tool to help learners determine needs and demonstrate capabilities.
A standardized approach to Competency Areas provides accessible information about what individuals need to know and be able to do, enables the development of more effective learning, and establishes regular processes to consistently describe and validate a learner's capabilities. Therefore, the following are both stakeholders and the audience for this work: employers; workforce development and human resources professionals; education, training, and certification providers; and learners. ## Document Conventions

The terms 'shall' and 'shall not' indicate requirements to be followed strictly in order to conform to the publication and from which no deviation is permitted. The terms 'should' and 'should not' indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited. The terms 'may' and 'need not' indicate a course of action permissible within the limits of the publication. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical or causal. Those seeking a career in cybersecurity or performing cybersecurity work-including students, job seekers, and employees-are referenced as Learners. This moniker highlights that each member of the workforce is also a lifelong learner. ## Note to Readers

This publication assumes existing knowledge of the Workforce Framework for Cybersecurity (NICE Framework) , NIST Special Publication 800-181, Revision 1, and is expected to be read in that context. This document was released in draft form for comment twice prior to this publication.

NICE Framework Competency Areas_ Preparing a Job-Ready Cybersecurity Workforce


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Vetting the Security of Mobile Applications provide? (Part 4)

[Assistant]
00-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.
## Abstract

Mobile applications are an integral part of our everyday personal and professional lives. As both public  and  private  organizations  rely  more  on  mobile  applications,  ensuring  that  they  are reasonably  free  from  vulnerabilities  and  defects  becomes  paramount. This  paper  outlines  and details  a  mobile  application  vetting  process. This  process  can  be  used  to  ensure  that  mobile applications  conform  to  an  organization's  security  requirements  and  are  reasonably  free  from vulnerabilities. ## Keywords

app vetting; app vetting system; malware; mobile applications; mobile security; NIAP; security requirements; software assurance; software vulnerabilities; software testing. ## Trademark Information

All registered trademarks belong to their respective organizations.

Vetting the Security of Mobile Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

t the Transmission Control Protocol/Internet Protocol (TCP/IP) layers that each is able to examine. TCP/IP communications are composed of four layers that work together to transfer data between hosts.
When a user wants to transfer data across networks, the data is passed from the highest layer through intermediate layers to the lowest layer, with each layer adding more information. The lowest layer sends the accumulated data through the physical network, with the data then passed upwards through the layers to its destination. Simply put, the data produced by a layer is encapsulated in a larger container by the layer below it. The four TCP/IP layers, from highest to lowest, are shown in Figure 2-1.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.:

The E2E Framework is governed by the security council, which is composed of cross-functional senior management from product engineering, product line management, information security, product security, supply chain risk and compliance (SCRC), facility safety and security, and legal. Quarterly security council meetings direct the implementation schedule for individual contributors from each function. While framework-based planning is a cross-functional exercise, the resulting controls are ultimately owned and operated by each function.

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

There  may  be  references  in  this  publication  to  other  publications  currently  under  development  by  NIST  in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until  each  publication  is  completed,  current  requirements,  guidelines,  and  procedures,  where  they  exist,  remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Office of Management and Budget Circular A-130 4 establishes general policy for the planning, budgeting, governance, acquisition, and management of Federal information, personnel, equipment, funds, IT resources and supporting infrastructure and services. The appendices to this Circular also include responsibilities for protecting Federal information resources and managing personally identifiable information (PII). The requirements of this Circular apply to the information resources management activities of all agencies of the Executive Branch of the Federal Government. The requirements of Circular A-130 apply to management activities concerning all information resources in any medium (unless otherwise noted), including paper and electronic information. When an agency acts as a service provider, the ultimate responsibility for compliance with applicable requirements of this Circular is not shifted (to the service provider). Agencies are required to describe the responsibilities of service providers in relevant agreements with the service providers. Agencies are not required to apply this Circular to national security systems (defined in 44 U.S.C. § 3552 5 ), but are encouraged to do so where appropriate. For national security systems, agencies shall follow applicable statutes, executive orders, directives, and internal agency policies.

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI):

| IAT = Processes | IAT = Processes | IAT = Processes | IAT = Processes | IAT = Processes | |------------------------------|-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------|----------------------------------------------| | Authorization Focus Area | Identifier | Issuer Control | Applicability | Source | | Issuance/ Activation Process | AI(DC)-5 | A mechanism to block use of the Derived PIV Authentication private key after a number of consecutive failed authentication attempts is implemented.

Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

| Purpose and Scope....................................................................................................
| 1                                                                                |
| 1.3                                                                                | Audience .................................................................................................................... | 1                                                                                |
| 1.4                                                                                | Document Structure.................................................................................................... | 2                                                                                |
| 2. | Background....................................................................................................................... 3      | Background....................................................................................................................... 3      |
| 2.1                                                                                | Deployment Models....................................................................................................

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Version 1.1 Manufacturing Profile provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. All NIST Computer Security Division publications, other than the ones noted above, are available at http://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000 Email: CSF\_Manufacturing\_Profile@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

This document provides the Cybersecurity Framework (CSF) Version 1.1 implementation details developed for the manufacturing environment.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

| Allocation [NISTIR 7298]           | The process an organization employs to determine whether security controls are defined as system -specific, hybrid, or common. |
|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Allocation [NISTIR 7298]           | The process an organization employs to assign security controls to specific information system components responsible for providing a particular security capability (e.g., router, server, remote sensor). |
| Application [NISTIR 7298]          | A software program hosted by an information system. |
| Assessment                         | See Security Control Assessment . |
| Assessment Findings [NISTIR 7298]  | Assessment results produced by the application of an assessment procedure to a security control or control enhancement to achieve an assessment objective; the execution of a determination statement within an assessment procedure by an assessor that results in either a satisfied or other than satisfied condition. |
| Assessment Method [NISTIR 7298]    | One of three types of actions (examine, interview, test) taken by assessors in obtaining evidence during an assessment. |
| Assessment Object [NISTIR 7298]    | The item (specifications, mechanisms, activities, individuals) upon which an assessment method is applied during an assessment. |
| Assessment Objective [NISTIR 7298] | A set of determination statements that expresses the desired outcome for the assessment of a security control or control enhancement. |
| Assessment Procedure [NISTIR 7298] | A set of assessment objectives and an associated set of assessment methods and assessment objects .

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to NIST Cloud Computing Forensic Science Challenges:

- Anti-forensics  (e.g.,  obfuscation,  data  hiding,  malware). Anti-forensics  are  a  set  of techniques used specifically to prevent or mislead forensic analysis. Anti-forensic challenges in cloud forensics include:
- o The  use  of  obfuscation,  malware,  data  hiding,  or  other  techniques  to  compromise  the integrity of evidence
- o Malware may circumvent virtual machine isolation methods
- Incident  first  responders  (e.g.,  trustworthiness  of  cloud  Providers,  response  time, reconstruction). Incident first responder challenges in cloud forensics include:
- o Confidence,  competence,  and  trustworthiness  of  the  cloud  Providers  to  act  as  first responders and perform data collection
- o Difficulty in performing initial triage
- o Processing a large volume of collected forensic artifacts
- Role management (e.g., data owners, identity management, users, access control). Role management challenges in cloud forensics include:
- o Uniquely identifying the owner of an account
- o Decoupling between cloud user credentials and physical users
- o Ease of anonymity and creating fictitious identities online
- o Determining exact ownership of data
- o Authentication and access control
- Legal (e.g., jurisdictions, laws, service level agreements, contracts, subpoenas, international cooperation, privacy, ethics) . Legal challenges in cloud forensics include:
- o Identifying and addressing issues of jurisdictions for legal access to data
- o Lack  of  effective  channels  for  international  communication  and  cooperation  during  an investigation
- o Data  acquisition  that  relies  on  the  cooperation  of  cloud  Providers,  as  well  as  their competence and trustworthiness
- o Missing terms in contracts and service level agreements
- o Issuing subpoenas without knowledge of the physical location of data
- Standards  (e.g.,  standard  operating  procedures,  interoperability,  testing,  validation).

NIST Cloud Computing Forensic Science Challenges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations:

reamline incident communications and reporting. 3. Engagement of executive leadership in C-SCRM: Executives and Boards of Directors are engaged in C-SCRM through regular presentations and touchpoints.
Such engagement demonstrates leadership commitment and importance of C-SCRM to the organization. 4. C-SCRM is driven by business priorities to ensure product and service delivery: CSCRM is considered one of the critical capabilities that reduce the risks of disruption to product and service delivery if an incident were to occur. Organizations shared a variety of practices on how they identify, prioritize, and respond to cyber supply chain risks.

Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Attribute Considerations for Access Control Systems:

As subject attributes may be provisioned by different authorities (e.g., human resources , security , organization leadership ,  etc.),  methods  for  obtaining  authoritative  data  must  be  regulated.  For example, only security authorities should be able to provision and assert clearance attributes and attribute values based on authoritative personnel clearance information; an individual should not be able to alter his or her own clearance attribute value. Other subject attributes may involve the subject's current tasking, physical location, and the device from which a request is sent. Processes need to be developed to assess and assure the quality of such subject attribute data.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Attribute-based Access Control for Microservices-based Applications using a Service Mesh provide? (Part 3)

[Assistant]
h  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
All  NIST  Computer  Security  Division  publications,  other  than  the  ones  noted  above,  are  available  at http://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sp800-204b-comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Deployment architecture in cloud-native applications now consists of loosely coupled components,  called  microservices,  with  all  application  services  provided  through  a  dedicated infrastructure, called a service mesh, independent of the application code.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Digital Identity Guidelines:

3.4.2. 3.4.2 and
Sec. 3.4.2 and
Sec.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) - a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following such practices should help software producers reduce the number of vulnerabilities in released software, reduce the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software acquirers can also use it to foster communications with suppliers in acquisition processes and other management activities. This document provides a common language to describe fundamental secure software development practices. This is similar to the approach taken by the Framework for Improving Critical Infrastructure Cybersecurity , also known as the NIST Cybersecurity Framework [NISTCSF]. 2  Expertise in secure software development is not required to understand the practices.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

itoring, WLAN-specific vulnerability monitoring involves analyzing WLAN communications and identifying policy violations, such as communications using the wrong protocols, encryption key lengths, etc.
This is effective at identifying misconfigured WLAN devices as well as devices that are acting differently than their configuration indicates. It is especially helpful when not all of the WLAN devices are under the organization's control, such as visitor laptops, and when unauthorized WLAN devices are a concern (e.g., an employee attaching a personal mobile device to an organization WLAN without authorization). This form of vulnerability monitoring is often provided by the same tools that are effective at attack monitoring, as explained in Section 3.2.

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

Session resumption considerations and server recommendations were given in Section 3.6. There are no specific recommendations for clients regarding session resumption when using TLS 1.2, 1.1, or 1.0. Clients typically will not know if any anti-replay mechanisms are in place to prevent replay attacks on 0-RTT data in TLS 1.3. Therefore, clients using TLS 1.3 should not send 0RTT data.

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process:

1. Chemical: Basic chemicals, specialty chemicals, agricultural chemicals, and consumer products
2. Commercial facilities: Entertainment/media, gaming, lodging, outdoor events, public assembly, real estate, retail, and sports leagues
3. Communications: Providers of voice services using interconnected terrestrial, satellite, and wireless transmission systems
4. Critical manufacturing: Metals; machinery; electrical equipment, appliances, and components; and transportation equipment
5. Dams: Critical water retention and control services
6. Defense industrial base: Research, development, production, delivery, and maintenance of military weapons systems, subsystems, and components or parts to meet U.S. military requirements
7. Emergency services: Highly skilled and trained personnel and physical and cyber resources that provide prevention, preparedness, response, and recovery services during day-to-day operations and incident response
8. Energy: Electricity, oil, and natural gas
9. Financial services: Depository institutions, providers of investment products, insurance companies, other credit and financial organizations, and providers of critical financial utilities and services that support these functions

Proxy Validation and Verification for Critical AI Systems_ A Proxy Design Process


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Maintenance?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures provide? (Part 3)

[Assistant]
ght, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-11-04 Supersedes NIST SP 800-55 Rev.
1 (July 2008) https://doi.org/10.6028/NIST.SP.800-55r1

## How to Cite this NIST Technical Series Publication:

Schroeder K, Trinh H, Pillitteri VY (2024) Measurement Guide for Information Security: Volume 1 - Identifying and Selecting Measures. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-55v1. https://doi.org/10.6028/NIST.SP.800-55v1

## Author ORCID iDs

Katherine Schroeder: 0000-0002-4129-9243 Hung Trinh: 0000-0002-3323-0836 Victoria Yan Pillitteri: 0000-0002-7446-7506

## Contact Information

cyber-measures@list.nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/55/v1/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

This document provides guidance on how an organization can develop information security measures to identify the adequacy of in-place security policies, procedures, and controls. It explains the measures prioritization process and how to evaluate measures. ## Keywords

assessment; information security; measurement; measures; metrics; performance; qualitative; quantitative; reports; security controls. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance:

| |---------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------| | 1.1 | Purpose.........................................................................................................................2 | | | 1.2 | Requirement Terms......................................................................................................3 | | | 1.3 | General Protocol Considerations .................................................................................3 | | | | 1.3.1 Mandatory-to-Implement versus Optional-to-Implement | .....................................4 | | 1.3.2 | Cryptographic Negotiation | ....................................................................................4 | | 1.3.3 | Single or Multi-Use Keys......................................................................................6 | | | | 1.3.4 Algorithm and Key Size Transition.......................................................................6 | | | 2 | Public Key Infrastructure (PKI) .........................................................................

Recommendation for Key Management, Part 3_ Application-Specific Key Management Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

|                                                                                | 8.5.3                                                                                | System Integrity ......................................................................................... | 8-8             |
|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-----------------|
|                                                                                | 8.5.4                                                                                | Multi-tenancy ............................................................................................. | 8-8             |
|                                                                                | 8.5.5                                                                                | Browsers.................................................................................................... | 8-9             |
|                                                                                | 8.5.6                                                                                | Hardware Support for Trust........................................................................

Cloud Computing Synopsis and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Incident Response?

[Assistant]
According to Fiscal Year 2024 Cybersecurity and Privacy Annual Report:

nder, and the National Software Reference Database added data from 10,000+ new or updated applications (totaling over 42 million files) to assist with computer security and digital forensics analysis.
- NIST published CSWP 36, Applying 5G Cybersecurity and Privacy Capabilities: Introduction to the White Paper Series ; CSWP 36A, Protecting Subscriber Identifiers with Subscription Concealed Identifier (SUCI): Applying 5G Cybersecurity and Privacy Capabilities ; CSWP 36B, Using Hardware-Enabled Security to Ensure 5G System Platform Integrity: Applying 5G Cybersecurity and Privacy Capabilities ; and CSWP 36C, Reallocation of Temporary Identities: Applying 5G Cybersecurity and Privacy Capabilities .

Fiscal Year 2024 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security Recommendations for Server-based Hypervisor Platforms:

.). - HY-BF3: Direct Execution of commands from Guest VMs - Certain commands from Guest OSs are executed directly by the hypervisor instead of being triggered through interrupts and context switching.
This function applies to hypervisors that have implemented para-virtualization instead of full virtualization
- HY-BF4: VM Lifecycle Management - All functions including creation and management of VM images, control of VM states (Start, Pause, Stop), VM migration, making snapshots, VM monitoring, and policy enforcement
- HY-BF5:  Management  of  hypervisor  platform  -  Defining  artifacts  and  setting  values  for  various configuration parameters in hypervisor software modules including those for configuration of a Virtual Network inside the hypervisor and updates and patching to those modules.

Security Recommendations for Server-based Hypervisor Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to General Server Security:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1                                                                                | Executive Summary..............................................................................................................ES-1   |
|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Report of the Workshop on Cryptography in Support of Computer Security:

comments and brief presentations. Professor Julian Bigelow, Institute for Advanced Studies at Princeton, welcomed the participants to the workshop and outlined the workshop objectives. Dr. Ruth Davis, Director of the Institute for Computer Sciences and Technology, gave an overview of the development process of the proposed Data Encryption Standard (DES). Technical presentations by ICST members and other workshop participants provided descriptions of the DES and how it may be used in computer systems.

KONHEIM ( IBM ) : IBM did estimate those costs, but we neglected to include the cost of development.

TUCHMAN ( IBM ) : My personal opinion is that if IBM were to build such a key searching machine consisting of a million special purpose chips, the development and production costs alone would result in a cost to the manufacturer an order of magnitude larger than the 20 million dollar figure that was estimated by Martin Heilman. The resulting machine would produce one key a day but would not be delivered before 1981 and the probability of success would be very low. IBM has no intention of building such a machine and I do not believe anyone would attempt to build such a machine.

Report of the Workshop on Cryptography in Support of Computer Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to A Threat Analysis on UOCAVA Voting Systems:

e for citizens overseas. In addition, registration and ballot requests can also take advantage of these distribution methods, but there are more threats when handling personal information from voters.
Voted ballot return remains a more difficult issue to address, however emerging trends and developments in this area should continue to be studied and monitored.

A Threat Analysis on UOCAVA Voting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

- The front matter describes configuration management recommendations.
- o Section 1.3 specifies the effective date of SP 800-73-5.
- The front matter also specifies NPIVP conformance testing procedures.
- Appendix G provides the full Revision History of SP 800-73.

SP 800-73-5 Parts 2 and 3 define two interfaces to an ICC that contain the PIV Card Application: a low-level card command interface (Part 2) and a high-level client API (Part 3). SP 800-73-5 Part 3 is optional, and NIST Personal Identity Verification Program (NPIVP) conformance testing for PIV Middleware in accordance with SP 800-73 Part 3 is discontinued since endpoints support high-level client API natively at the time of this publication.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Information and Communications Technology (ICT) Risk Outcomes_ Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio:

| Function | Category | Subcategory | Implementation Example | |------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | GV.OV-5: Risk is identified, adjudicated, and tracked by risk management programs according to published formats.

Information and Communications Technology (ICT) Risk Outcomes_ Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Approaches for Federal Agencies to Use the Cybersecurity Framework:

| Benefit(s): • Facilitate communication among agency stakeholders, including executive leadership. • Facilitate a common language to inform and be informed by other risk management disciplines. | Primary SP 800-37 Level: 1 - Organization Primary Cybersecurity Framework Component: Core                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Summary: Using the Cybersecurity Framework's Functions (Identify, Protect, Detect, Respond, and Recover) as the basis for risk management dialogues related to the cybersecurity environment, organizations can raise awareness of cybersecurity and other risks to be managed and facilitate communication among agency stakeholders, including executive leadership. 4 This use example aggregates elements of the activities of uses 2-8.

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for Media Sanitization:

| Executive Summary............................................................................................................................1      |
|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2 |
| 2. Background....................................................................................................................................5  |
| 3. Summary of Sanitization Methods..................................................................................................8               |
| 3.1.1. Clear Sanitization Method............................................................................................................8       |
| 3.1.2. Purge Sanitization Method.........................................................................................................10         |
| 3.1.3. Destroy Sanitization Method......................................................................................................11          |
| 3.2.1. Strength of Cryptography for CE ................................................................................................12           |
| 3.2.2. Applicability of CE.......................................................................................................................13 |
| 3.2.3. Sanitization of Keys ....................................................................................................................13  |
| 3.2.4. Quality of Cryptographic Implementations................................................................................15                   |
| 3.2.5.